Hacker News Reader

Correct me if I'm wrong, but looks like this should only be a vulnerability if your app uses XML parameters?

No, it's a vulnerability if your app SUPPORTS XML parameters, which all modern Rails apps do.

This vulnerability is exploitable even if you don't have any exposed controllers.

Wait, what? What if the app does not parse ANY user provided XML or YAML at all?

That does not matter.

Holy cow. I just figured out how to send the payload. This thing is seriously bad news.

I still haven't figured out an attack vector yet, but least I now know that my patches are working!